Oversight Needs Evidence: Pope Leo's AI Encyclical and the Machine-Readable Web
Tom Cranstoun · The Machine Experience Authority · CogNovaMX Ltd
On 25 May 2026, Pope Leo XIV published his first encyclical, Magnifica Humanitas, on artificial intelligence. He signed it on 15 May, 135 years to the day after Leo XIII signed Rerum Novarum, the 1891 letter on the rights of workers in the middle of the industrial revolution. The choice of date is the argument in miniature: this is the industrial revolution again, and the question is the same one it was in 1891. Who is this for, and who answers for it.
I am not going to write about the theology, which is not mine to interpret. I want to pull out one thread, because it is a thread I work on every day. The encyclical asks for four practical things: enforceable legal frameworks, independent oversight, informed users, and a political system that does not abdicate its responsibility. Read that list again with an engineer's eye. Every item on it is a documentation problem before it is a moral one.
You cannot oversee what you cannot inspect
Independent oversight is a fine phrase. It means almost nothing unless the thing being overseen leaves a record an outsider can read. An auditor who has to take the operator's word for what an AI system did, on what basis, citing what source, is not conducting oversight; they are receiving a story. The difference between the two is evidence: a record of what happened that the auditor can verify without the operator's cooperation.
Most AI output today does not produce that record. A model answers, a page is published, a decision is made, and what survives is the output and a vague sense of where it came from. When a regulator or an auditor arrives later and asks the medieval questions - who produced this, on what authority, has it been altered - the honest answer is usually a shrug and a reconstruction. Oversight is being asked to operate on inference. It is the same failure that makes machines hallucinate, scaled up to institutions.
"Informed users" has the same shape. You cannot inform a user with content that cannot tell them anything about itself. A page that does not say who wrote it, when, under what authority, or whether a human reviewed it leaves the user exactly as uninformed as the agent reading on their behalf. Informed is not a feeling but a property of the content.
What the evidence has to look like
This is the unglamorous part, and it is the part I spend my time on. For oversight to have something to inspect and for a user to be genuinely informed, content has to carry its own evidence, in a form a machine can check.
That splits cleanly into two jobs. The first is making content machine-readable: explicit provenance, context, and intended use, recorded as metadata that travels with the file rather than living in one company's database. That is MX. The second is making content machine-trustworthy: signing those claims so a reader or an agent can verify, on their own side, who said it and that it has not changed since. That is Reginald, the registry layer that holds and serves the signed claims and produces attestation records a client checks for itself.
Readable without trustworthy is a tidy story anyone can rewrite. Trustworthy without readable is a locked box. Put together, they produce the one thing the encyclical's list quietly depends on and never names: queryable, verifiable evidence. An auditor can walk from a regulatory clause to every decision that cited it. A user, or the agent acting for them, can see whether a fact arrived attested by a named source or was assembled from guesses. The oversight the Pope asks for becomes something you can actually perform, rather than something you assert.
The limit, stated plainly
I have to be honest about what this is not, because the failure mode of governance technology is to promise more than it can hold.
MX and Reginald grant no compliance with the EU AI Act, the European Accessibility Act, or any of the instruments now arriving, and they confer none of the moral standing the encyclical is really about. They are an evidence vehicle, nothing more. The legal duty stays with the organisation. The moral duty stays with the people who build and deploy the systems. What the architecture does is narrower and useful: it makes the documentation those duties already require structured, tamper-evident, and verifiable on request. Sold as that, it is honest. Sold as "ethics in a box", it collapses on the first inquiry, and deserves to.
The encyclical is a moral argument. MX is plumbing. I am not pretending the second is the answer to the first, but a moral argument about accountability needs plumbing to land. A call for oversight with no mechanism to record what happened is a sermon, and everyone nods, and nothing is inspectable on Monday. The mechanism is dull on purpose: the right metadata, claims that are signed, a registry anyone can verify against, verification that runs on the reader's side and not on trust.
Leo XIV asks who is responsible for the output. It is a fair question, and an old one, and we have spent the AI race so far being unable to answer it cleanly. The least the people who fill the web with content can do is build content that helps answer it - content that can say who made it, when, and on whose authority, and prove it. That does not settle the moral question; it just stops us pretending the moral question is unanswerable because the record was never kept.
Tom Cranstoun is the Machine Experience Authority and founder of the MX community. He consults on MX strategy through CogNovaMX Ltd.